New Exploit Attacks UK Routers and Runs Up Mobile Data Bills

Some customers of business-focused UK mobile data (broadband) operator Anvil Mobile have been hit by a new exploit, which hijacks end-user routers and then proceeds to spew out cyber-attacks. The result is a compromised network and large data bill, but customers on other operators may also be affected.

Anvil is an operator that typically offers business grade mobile data and fixed IP services via Three UK, Vodafone, EE and O2 (VMO2) as part of multiple MVNO agreements, which is rather different from the single-operator MVNO arrangements that we often see from more familiar consumer brands.

However, the operator recently came to our attention for a very different reason, which began after ISPreview.co.uk was informed by customers that Anvil had begun sending out notification emails about an “Overuse Issue” on some accounts. The email claims that “all networks” are reporting that, since 4th July 2022, there has been a “spate of cyber-attacks” that have exploited flaws in “older firmware versions of several popular routers.”

The exploit, which Anvil rather annoyingly fails to identify, then goes on to compromise the customer’s router. After that, the router becomes a source of “automated attacks and web scraping across many services on the internet“. Not only does this compromise the customer’s network, but it can also run up a large data bill, as confirmed by one of the affected customers.

Anvil correctly points out that this is “not a network or SIM issue and the overuse will be billable (monthly in arrears),” although thankfully the operator is currently being very proactive in notifying customers who they believe may have been compromised. Sadly, not all operators are quite as proactive.

The operator also warned that those with compromised routers (usually third-party devices) could find their SIM being suspended, which may occur if the attack traffic from their connection results in abuse reports (broadband ISPs sometimes do this too) or the customer is in danger of running up a huge / abnormal data bill.

Extract from Anvil’s Message

As we have noted that your SIM has an excessive increase in data use recently we are highlighting the potential for your device to have been compromised, if you are not aware of any reason for the increased usage we strongly urge you to pass on the following information to your engineers or whoever is responsible for your SIM hardware to take the following measures to ensure the security of your device.

➤ Factory reset and upgrade your router to the latest firmware version.

➤ Set up the router again ensuring that any unused ports or services are closed/disabled.

➤ Check any connected devices such as laptops or PC’s for malware/ viruses.

➤ If possible set up IP whitelisting to ensure only approved hosts can access the router.

If we receive notification to our abuse email regarding a SIM attacking servers or any other malicious activity we will immediately have no option but to suspend the SIM and inform you to stop any additional usage as this results in large invoices due to the volume of traffic.

If you are at all concerned or would like the SIM suspended pre-emptively so you can check the device/ perform the steps above please don’t hesitate to contact us.

Naturally, we attempted to contact Anvil about all this, but they’ve yet to respond to our email. However, the only notable router-targetting malware that we’re aware of as being very active since early July 2022 is the highly sophisticated ZuoRAT (likely developed by a state sponsored actor), which is known to target small office / home office (SOHO) routers.

The aforementioned malware is a multistage remote access trojan (RAT) that grants an attacker the ability to pivot into the local network and gain access to additional systems on the Local Area Network (LAN) by hijacking network communications to maintain an undetected foothold. Once exploited, the malware can capture packets being transmitted on the router and stage man-in-the-middle attacks through DNS and HTTPS hijacking.

Some of the known vulnerabilities associated with this malware, focusing on how it accesses routers to spread the RAT, include: CVE-2020-26878 and CVE-2020-26879. Both of which were first discovered in 2020, which may explain the earlier reference by Anvil to older firmware. Numerous SOHO router manufacturers have kit that could be exposed to this if not updated, including ASUS, Cisco, DrayTek and NETGEAR.

Some people may also be using re-branded versions of the aforementioned router brands, which is why it’s wise check that you’re on the latest firmware, even if you don’t think you’re unaffected by this. If you fear that your router has been compromised, a simple restart of the infected device should remove the initial ZuoRAT exploit, but only a factory reset will fully clear it, and you’ll then need to update the firmware to avoid reinfection.

I must stress that we don’t yet know if the issue being experienced by Anvil’s customers is indeed ZuoRAT, but from the description they’ve given, and the timeline, it does sound likely.